You should force a redirect of anything http to the corresponding https URL. You can do it dynamically so it preserves any direct links in case you're worried about that.